IGMP queries from the AP7532 without settings applied

[Arthurooo]

Hello,

Our AP is still sending IGMP queries on the network even if the querier setting is disable on profile.
IGMP queries are sent from the AP on VLAN 5 and cause conflict on the network.
On our architecture, we decided to set the querier on a another switch due to sepecific use cases.

First we needed to deactivate ip spoofing firewall rule beacuse the AP dropped IGMP queries from the switch. But even if ip spoofing is deactivated, sometimes some clients answer to both queriers on the ,network (the AP and the switch) and it can cause brief and total disconnections of clients watching multicast flows (e.g cameras).
Please find below the AP configuration:

!
! Configuration of AP7532 version 5.9.1.4-004R
!
!
version 2.5
!
!
client-identity-group default
 load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos ipspoof
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
 rate-limit client to-air rate 5000
 rate-limit client from-air rate 5000
 qos trust dscp
 qos trust wmm
 accelerated-multicast 239.1.172.203 classification video
 accelerated-multicast 239.1.172.204 classification video
 accelerated-multicast 239.1.172.205 classification video
 accelerated-multicast 239.1.172.206 classification video
 accelerated-multicast 239.1.172.207 classification video
!
radio-qos-policy default
 admission-control video max-clients 25
 admission-control video max-roamed-clients 256
 admission-control video max-airtime-percent 150
 admission-control video reserved-for-roam-percent 12
 accelerated-multicast max-client-streams 4
 accelerated-multicast stream-threshold 500
 accelerated-multicast client-timeout 30
!
wlan 1
 ssid SSID1
 vlan 5
 bridging-mode local
 encryption-type ccmp
 authentication-type none
 no fast-bss-transition over-ds
 wpa-wpa2 psk 0 123456789
!
wlan 2
 ssid SSID2
 vlan 11
 bridging-mode local
 encryption-type ccmp
 authentication-type none
 no broadcast-ssid
 no answer-broadcast-probes
 no fast-bss-transition over-ds
 wpa-wpa2 psk 0 1234567891
!
wlan 3
 ssid SSID3
 vlan 1
 bridging-mode local
 encryption-type ccmp
 authentication-type none
 no broadcast-ssid
 no answer-broadcast-probes
 no fast-bss-transition over-ds
 wpa-wpa2 psk 0 1234567892
!
wlan CONFIG_ID
 ssid 12b25aec52a29c946e21ccbd685c3d93
 vlan 1
 bridging-mode local
 encryption-type ccmp
 authentication-type none
 no fast-bss-transition over-ds
 wpa-wpa2 psk 0 12345EDCBAX
!
dhcp-server-policy WiNGExpressDhcpSvrPolicy
!
!
management-policy default
 no telnet
 no http server
 https server
 ssh
 user admin password 1 e8aaf41a4b1781b2f65b35e450030684d38ed12bbe3614191c37d192f331e02c role superuser access all
 snmp-server manager v2
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
event-system-policy default
!
nsight-policy default
!
profile ap7532 default
 no ip igmp snooping
 no ip igmp snooping forward-unknown-multicast
 autoinstall configuration
 autoinstall firmware
 crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
 crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  channel 1
  power 20
  wlan 1 bss 1 primary
  wlan 2 bss 2 primary
  wlan 3 bss 3 primary
 interface radio2
  channel 44
  power 20
  wlan 1 bss 1 primary
  wlan 2 bss 2 primary
  wlan 3 bss 3 primary
 interface ge1
  switchport mode trunk
  switchport trunk native vlan 1
  no switchport trunk native tagged
  switchport trunk allowed vlan 1,5,11
 interface vlan1
 interface vlan5
 interface vlan11
 interface pppoe1
 use event-system-policy default
 use firewall-policy default
 use client-identity-group default
 logging on
 service pm sys-restart
 router ospf
 adoption-mode controller
!
rf-domain default
 timezone Europe/Paris
 country-code fr
 use nsight-policy default
!
self
! ap7532 94-9B-2C-2A-68-78
 radio-count 2
 use profile default
 use rf-domain default
 hostname ap7532
 license AP VIRTUAL_CONTROLLER_DEFAULT_AP_LICENSE
 no adoption-site
 location default
 ip default-gateway 192.168.104.1
 interface radio1
  shutdown
  channel 1
 interface radio2
  shutdown
  channel 44
 interface vlan1
  no description
  ip address 192.168.104.3/24
  no ip nat
 interface vlan5
  no description
  ip address 10.224.250.3/12
 no use dhcp-server-policy
 no virtual-controller
 rf-domain-manager capable
 no ip dns-server-forward
!
!
end

Please find a Wireshark capture screenshot following a capture done on the AP using the command line, “service pktcap on radio all”:

10.224.250.3 → AP IP address

10.241.14.1 → Switch IP address

I’m quiet new with Wing AP and i’d like to understand what I’am missing or settings to be refine in the configuration.

Thanks for your help !

Regards

Arthur

[Arthurooo]

Hi Ovais,

Thanks for the reply and investigation. After doing some tests with our architecture, we found that this IGMP query didn’t have conflict with other IGMP queries.

In my opinion, it should be interesting to make a note in documentation saying that with multicast accelerated feature, the AP can send IGMP query and can generate ip spoofing attack (if other queriers are configured on the network) if the ip dos ipspoof event on the firewall is configured.

Thanks for your help on this subject.

Regards,

Arthur

[Ovais_Qayyum · Accepted solution]

Hi Arthur,

I was finally able to reproduce this in my lab and have a fair bit of idea about what you are seeing in your setup. 

I am able to see the IGMP query messages from the AP when the client is getting connected. This query message is getting sent as part of multicast to unicast conversion, this is independent of IGMP configured in VLAN. This IGMP query message is needed if mc2uc conversion is required. So, disable mc2uc to avoid IGMP query messages from the AP. This will degrade the performance of multicast traffic to some extent though.

To add further, in some cases, you might also see an IGMPv1 query even if the configured version is IGMPv3. It is decided based on the version of the IGMP membership report sent by the wireless stations. If the IGMP membership report is not received from the station then IGMPv1 will be used as default. In case of IGMP querier is enabled on the AP then configured IGMP version will be used for sending IGMP query as part of mc2uc conversion.

Regards,

Ovais

[Ovais_Qayyum]

Hi Arthur, 

I thought of updating the thread. We have noticed this behavior in one more instance as well and are currently investigating the cause of it. As soon as there is an update, I will let you know.  

Regards,

Ovais

[Arthurooo]

Hi Ovais,

By using the service pktcap capture on radio, we saw that the specific query was coming from the AP as outbound traffic. If we used the ip acces-list BROADCAST-MULTICAST-CONTROL for outbound traffic, it didn’t improve anything, we saw again the unexpected IGMP query.

To be sure, we refine the IGMP rule in order to deny outbound IGMP traffic coming from 10.224.250.3 to 224.0.0.1. It shows us the same result, the unexpected IGMP query was always sent by the AP.

We tried to remove the IP 10.224.250.3 from the VLAN 5 (please refer to configuration above) and the AP was still always sending IGMP queries but with another IP address. This ip address was based on the MAC address of the AP.

Another interesting thing is, when there are no devices connected to the SSID, and if we capture the traffic as the same time, we don’t see this unexpected query. I observed the query  when I connected multiple devices (IOS and Android smartphones) to the SSID.

Regards,

Arthur